PR#4515: More csp fixes: inline onsubmit statements - pagure

pagure

#4515 More csp fixes: inline onsubmit statements

Merged 4 years ago by pingou. Opened 4 years ago by jlanda.

jlanda/pagure onsubmit into master

Drop all the inline "onsubmit()" calls

Julen Landa Alustiza • 4 years ago

2db43ba

pagure/templates/comment_update.html

file modified

+1 -2

		`@@ -5,8 +5,7 @@`
		`{% block repo %}`
		`<section class="edit_comment">`

		`- <form action="{{ request.base_url }}" method="post" class="pr_comment_form"`
		`- onsubmit="return try_async_comment(this, null)" >`
		`+ <form action="{{ request.base_url }}" method="post" class="pr_comment_form">`


		`<fieldset class="form-group">`

pagure/templates/issue.html

file modified

+5 -1

		`@@ -149,7 +149,7 @@`

		`<form action="{{ url_for('ui_ns.update_issue', username=username,`
		`namespace=repo.namespace, repo=repo.name, issueid=issueid)`
		`- }}" method="post" onsubmit="return try_async_comment(this)" class="mainform">`
		`+ }}" method="post" class="mainform">`
		`{{ form.csrf_token }}`
		`<div class="row mt-4">`
		`<div class="col-md-8 mt-2">`
		`@@ -673,6 +673,10 @@`
		`return confirm('Do you really want to remove this comment?');`
		`});`

		`+ $('.mainform').submit(function() {`
		`+ return try_async_comment(this);`
		`+ });`
		`+`
		`$('.mainform #assignee').selectize({`
		`valueField: 'user',`
		`labelField: 'user',`

pagure/templates/pull_request_comment.html

file modified

+1 -1

		`@@ -9,7 +9,7 @@`
		`namespace=repo.namespace,`
		`requestid=requestid, commit=commit, tree_id=tree_id, filename=filename,`
		`row=row) }}"`
		`- method="post" onsubmit="return try_async_comment(this, true)">`
		`+ method="post" class="add_comment_form">`


		`<div class="tabs ui-widget ui-widget-content ui-corner-all"`

pagure/templates/repo_master.html

file modified

		`@@ -431,6 +431,10 @@`
		`}`
		`);`

		`+ $('.pr_comment_form').submit(function() {`
		`+ return try_async_comment(this, null);`
		`+ });`
		`+`
		`{% endif %}`
		`</script>`
		`{% endblock %}`

pagure/templates/repo_pull_request.html

file modified

+16 -5

		`@@ -362,8 +362,7 @@`
		`username=repo.user.user if repo.is_fork else None,`
		`namespace=repo.namespace,`
		`requestid=requestid)`
		`- }}" method="post" class="icon"`
		`- onsubmit="return try_async_comment(this, null)" >`
		`+ }}" method="post" class="icon form_pr_drop_comment">`
		`{% endif %}`

		`{{repo_renderdiff(diff=diff,`
		`@@ -388,8 +387,7 @@`
		`username=repo.user.user if repo.is_fork else None,`
		`namespace=repo.namespace,`
		`requestid=requestid)`
		`- }}" method="post" id="request_comment"`
		`- onsubmit="return try_async_comment(this, null)">`
		`+ }}" method="post" id="request_comment" class="form_pr_drop_comment">`

		`{% if pull_request.comments %}`
		`{% for comment in pull_request.comments %}`
		`@@ -447,7 +445,7 @@`
		`username=repo.user.user if repo.is_fork else None,`
		`namespace=repo.namespace,`
		`requestid=requestid) }}"`
		`- method="post" onsubmit="return try_async_comment(this, false)">`
		`+ method="post" class="form_pr_add_comment">`
		`{{ mergeform.csrf_token }}`
		`<div class="card-body">`
		`<textarea class="form-control" rows=8 id="comment" name="comment"`
		`@@ -1009,6 +1007,14 @@`
		`}`
		`});`

		`+ $('.form_pr_drop_comment').submit(function() {`
		`+ return try_async_comment(this, null);`
		`+ });`
		`+`
		`+ $('.form_pr_add_comment').submit(function() {`
		`+ return try_async_comment($this, false);`
		`+ })`
		`+`
		`{% if pull_request %}`
		`{# These lines are only for existing pull-requests, not new ones #}`

		`@@ -1276,6 +1282,11 @@`
		`})`
		`return false;`
		`};`
		`+`
		`+ $(".add_comment_form").submit(function(event) {`
		`+ return try_async_comment(this, true);`
		`+ })`
		`+`
		`{% endif %}`

		`</script>`

pagure/themes/srcfpo/templates/repo_branches.html

file modified

+1 -2

		`@@ -95,8 +95,7 @@`
		`username=username,`
		`namespace=repo.namespace,`
		`branchname=branch)`
		`- }}" method="post" class="icon d-inline"`
		`- onsubmit="return confirm('Are you sure you want to remove the branch: {{ branch }}?\nThis cannot be un-done!');">`
		`+ }}" method="post" class="icon d-inline delete-branch-form" data-branch-name="{{ branch \| unicode }}">`
		`{{ g.confirmationform.csrf_token }}`
		`<a title="Remove branch {{ branch }}" href="#"`
		`class="btn btn-outline-danger"`